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Abstract 

INSAT-2E is a multipLfrpoac Gcosiationary SatelliEe, Atlilude and Oifci! Control 

ffeyEietn (AOCS) is a mission critical system of the satellite. This paper discusses the 

software dovclopmont for the on-boar(;£ computer of a such a mission crilical system. 

[Etforts are matfe to adopt standard software engineering practices within tho limitation 

tli& application environ mont. Tine pciformance cjf the software with pre and post 

lunch of the sateflite has been vety much satisfactory. 

1, JntfodLiction: 

INSAT-2E IS a GeOiitdtiuridTy Satellite launched on 3rd Apri] 199-9i. This is Hie 

[Wth sateititc in the INSAT - 2 series. This carries communication payload as well as 

steorologicaS payloads. Eversince the launch of first satollite en October 1'954, (he 

Dgress in the area of satsllite technology has beeri very significant. Today's satellite 

[demands Jligher pomtfng and stabtlily requirements. This is also true in case of INSAT- 

TTiQ demand of high pointing and stability requirements result in complex AOCS in 

Idrtion to very hfgh reSfability for loing duration {12-15 years) uninton^jpted mission fife. 

The AOCS ts an integral part of the satclllta. It does the function of contrail ing 

lude errors and stability despite of several dJstuttjances acting on the satellite 

lamics- Block diagram of a typical AOCS Is given in fig. 1 . The AOCS consists of 

jde and orbit control computer (AOCC), sensors ancf actuators. The AOCC 

sives the error and error rate signals from various sensors such as earth sensors, 

I sensors and rate gyros. The received signals from tho sensors are processed by 

AOCC in accordance with predefined control laws using contreNcr. The output of 

controller is fed to actuators such as momentum/reaction wheel&t tiirusters and 

letic torque rs- These actuators mour^ted on satellite provide required correcting 

jes. Thus, satellite is stabilized despite disturbance torque acting on it, 
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\n addition to scnsoi^ and actuators, AOCC also intorfaccs witii various other 
systems of tine satellite. BfocK schematic of AOCC along with its interfaces is shown in 
Jig. 2.. The inteifaco with leiecommarid gives the capability of commandinci ihe AOCC to 
required mode of operation. The telemetry interface provides ting r^quirod health 
monitoring of tho AOCC. Power system provides the power lo ffne AOCC wTiereas solar 
array drive enables AOCC to control the solar array position. Meteoroiogical payload 
interfaces ars rei:iuired to synchronics AOCC with the pay load operation for accurate 
imaging. More details of AOCC hardware may bo found in nef [2], The AOCC is 
designed using MIL-STD-1750A processor and *ie software is developed in Ada 
language for better software reliability. In this papor, wo present the software design of 
INSAT-2E AOCC, In the following sectior^ we present th^e briof summary of functional 
requirements of the ]NSAT-2E AOCS operation. Then we give the design constraints, 
design methodology and development environment in section 3. This section is 
followed by ttie software design description in deiails. Here, the various components of 
software design are discussed. Finally, the ground as well as onboard performances ot 
AOCC software are highlighted. 

2. Functional Description; 

Starting ftom [auncti pad, tho satellite undergoes various phases of ifie mission. 
I1MSAT-2E mission profile with reference to tha AOCS operation is shown in fig 3. 

Initially, the satellite is kept in launch phase configuration where AOCS, only 
performs liousekceping monitoring functions and commanding operation. The 
controller operations are kept in non-active mode caEled suspended mode. During the 
launch vehicle separalion phase, the AOCS automatically orients tho spacecrafl in sun 
acquisition mode where the folded solar panel mounted on spacecraft soutti side are 
pointed towards sun, called soulfi sun acquisition moda. It is then followed by earth 
acquisition, to poinl towards earth for gyro catibration, Ttie spacecraft oriait is then 
changed from treinsfcr orbit {200 km x 35,000 km) lo about asoOO-km circular orbil by 
firing the Liquid Apogee lector (LAM) in LAM mode. Thereafter, the on-orbi( sun 
acquisition mode called eastAvest sun acquisition, earth acquisiiion, appendages 
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deploy meril and final on-Ofbit mcide are folfowcd before the spacecrafj is msde 
operational for payload oper^ition, The spacecraft orbtl keeps on drifting due to various 
dislurbances. To correct this drift a special nrsode callad station l<ecping is provided. 
TtiJs staliori-l<eeping modn keeps the spacecraft in proper orbit. Further details ot ttie 
spacecraft operations are be/ond the scope of this paper and are found in mi [6], 

As mentioned above, the spacecraft goes Ml rough several modes of fts operation . 
The AOCC keeps on acquiring censor data at regular imervai. All the reiermetry and 
commanding operations are executed at reguFar fntervaf. Lis! of important software 
functions are given in Tabfo 1 along with the periodicity, option avaiiabit), and execution 
corrirol option, etc. 

Before going into the details otthe software design aspects, we first give brief fy 
tho software application environment in which the software is to t^e developed and the 
softvraro deveiopment methodology, 



3. Software Application Environment: 

The design of software is largeiy infJuGncgd by its application e-nviroriment. For a 

; spacecraft application the software is constrained by soveral factors A suilabie 

[ 

; development methodology is needed to dcvslop such software for suc^ a high reliable 

. application. De-velopment envfronmont also plays an important rofe in the software 

j development. In this section, the design constraints, design methodoiogy and 

(development environment are briefiy described. 

13. 1 Design Constraints: 

I To appreciate fho software development methodology, it is important to Itnow the 

j constraints under which tile software is- to be deveiopod. Some of the constraints in the 
[development of our AOCC software are given balow: 
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Computational Speed: 

Onbgard applications in spacecraft need rad-hard and highly reliable processors. 
Very few processors arc avaiiabUe in Tills cetogory and are not comparable to the latest 
available commercial processors in terms of arctlitecturo and speed. 
Physical Limitation: 

Weight, volume and power are always limitod for a spacecraft systeTn. A good: 
software rnethodoiogy hefps in davo loping software with loss memofy jsage and Jess 
computatiorv time and also it provides with clear and simple softwano. 
Developinent Support: 

A good development tool is essantiai for developing good software. Presently we 
are using the in-fiouse development tool and the tool supports the software 
development througfYOUt its life cycle. 
Requirements and Changes; 

The methodology stiould be capatile of tolerating charges at any stage ol' 
development, Many a limes' design has to start with partial requirements. This is due 
to the fact that system design remains tentative till spacecraft design is completed and i( 
wilt be !ato to start, if one has to wait till the design of spacecraft is conftpieted. 
Therefore, the software structure should be flewble to accommodate cl^anges, even at 
later stage till complete requirements are available. 
Reliability: 

The space syslem'-s software should bo highly reliable as the spacecraft is 
irrepairabie in space and it is required to function continuously for 10 to 15 years. 
Susceptibility to Single Event Upsets: 

Single ovent ypset is a common phenomena in an onboard system due to 
cosmic radiations. The software should be designed to tolerate such upsets -without any 
advsrso impact- 
3.2 Design Methodology 

Fig. 4 shows the AOCC software development methodology. The integrated 
design approach of development of AOCC software consists of the following steps to bo 
performed in secjuenco- 

• Detemnine hardware interf acos 
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Assign pncicass^s to the end functions 

Decompose the middle part 

Hetemnine concumenoy 

Determirm process interfaces 

Introduce Intamnedsaiy proccssos 

Encapsulate la£l<s in packsages orlibraiy units 

Translate design into suitable program design language (PDL) 

Decompose large tasks further and conduct revjev^rs 
3.3 Developmeni Environment 

The AOCC software was dcvolopsd on an IBM RS6000 Unix platformi. 
TLD system supplied the compiler, assembler for 1750 A. linker, debugger and 
simutator. Fig. 5 shows the schematic of full software development envfronment. 
After comploJ'Q sofiware development, using in-house developed Development 
Tool (DT) cortiptcto software can be downloaded lo actu<il AOCC haidware and 
complete integrated tests can be carried out using debugger. Tfie In-house 
dovefopecf DT is having a moriitor program which supports function such as start 
up ROM emulation, memory rcad/vmte, lO operations, register read/write, break 
point execution, conditional break point oxeoution, direct exeomion, cxoculiort 
through scnpt file, internjpt execution etc. The DT was interfaced with \BM RS- 
60{)0 thn^ugh RS-232 Unk with baud rata of 9600. The iBM RS6000 workstation 
with in-house deveJoped DT was serving as fuU-fledgod development 
environment for AOCC softvifane development. This devefopment set-up Is unique 
and can be used tor software development of different types of spacacraft. 

4. AOCC Software Development : 

j AOCC EoftVi'are Is mission critical on -board software since no modification or 

repair is possible onca the spacecraft is launched. So, a sys.tematic software 
developmeot approach is used durfng software development, Identifying clearly the 
following phases of software devefopment follows softv/a re-engineering practices. 

Requirement Analysis 

Design 



. Coding 

• Testing 

Folio wing gives a brief description of lactiviMes carried out duiirtg each phases of 
software dovQlopmem specifically from the point of view ffiat software for 1NSAT-2E 
AOCC is developed using higher tevcl language Ada. 
4.1 Requirement Analysis 

Trie AOCC software should have a real time executive which siiould complete 
oxcculion in 32,766 msec with at lopst 25% margin in execution time and this execufion 
should take plac9 tsvory 32.768 msec, The AOCC software requirements are classlffecf 
in tCJ four major portior>s, 

Modfl praprocessing 

• Mod&processEng 

• Mode Post processing 
» Tin© Synchronization 

The schematic of AOCE cyde is shown in fig. 6, 
IVlodo preprocessing; 

The AOCC software configuration is mainly idsntifiod by the mode in which the 
AOCE is operating, Im this portion activities, vuhich are to be carried out prior to mada 
pfocessing, aro done. Major functions in ffiis portion ane 

• Telecommand processing 

• Telemetry processing 

. Dafa Acquisition (sensor) 

» Data pTOCOSEing (sensor) 

Since fhe processed data is used by mode processing routine, these functions 
are to be carried out prior to mode processing in the time domain. 
Mode Processirgi 

Ttio AOCC software should meet the requirements of feltowlng modes of 
operation, 

• Launcher phase 

• South Sun Acquisition 

> Transfer Orbit Earth Acquisition 
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LAM Mode 

EastWest Earth Acquisition 

Syriichronoijs Orbit Earth Acquisition 

Station Kocpirg MckJ^ 

On-Ori3it Mode 

Safe Mode 
Mode Post procQssing: 

In this module, routines that arc required to be executed after the compleliort of 
mode processing are done, FoEiowing moduJes are caiied in this portion. 

• Quaternion Computation 
. pVi/PFM Computation 

• MW/R W Con troiier Computation 

• MTC Obsen/er Computation 

• Actuator 0/P Processing 
Time Synchronization: 

All th^ modutgig ane to be executed" onoe in a cycle. The cycJc timo is 33.766 
iDs^c. Once a[i Ilie activilies are completed in a cycle, this routine will i^e cailed lo 
synchronize the time so tliat ali the activities are synchronized with repctrtivo period ot 
cycle tirne. This routine waits for a hardware timer output to become active and restarts 
the cycie and ai^so reset the hardvrare timer. 

Ail Vne new requirements of fNSAT-^E were gathcrc'd and a draft copy of 
requirement document was prepared. A speciai expert comminee rcvicv^cd tho 
requirements for its completeness and requirements were validated, A software 
requirement document was prepared incorporating ail the con^menls provided by the 
committee. 



4.2 Dos [gn Phase 

The software design carried out in earlier AOCCs was taken as a base line and tho 
requirements are represented by flow diagrams. New requireroents are incorporated in 
Ihe flow diagram. Design analysis was carried out to optimize tho tiow diag^rams. Here 
top down approach tor software deveiopment was used. All Ihe require mgnts are 
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decomposed into furtctiorial blocks and made as modules. Modules, which constituto 
qne function, anq combinDd uniJer a package. Modular approach vugs followed and 
modules are segregatecf like computaticnai bound module, data acquisition mixiuies, 
actuator rolatc-d prooessing modules, lO related module, etc. This type of 
decomposition gives reusability feature of sprtwartj reuse for dlffarent types of 
spacecraft. IVIost of the compulations are earned out in 32 bit floating point arithmetic. 
Whenever 32'bit pneossslon was not sufficient, extended precession of 48 bit long ffoal 
connpulations were used. Tnuncatton ennors in value accumulation were closely checked 
and proper care has been taken to adopt the single precession/extended precession 
oomputatton, so that effect of truncation error is minimized. A design document wag 
fnado and design review was carried out, Review cornmittee recommendations were 
incorporated in tho final software design document. Strict software configuration control 
iwas mainiaJned by having reviews tor any change incorporation. Any change used to 
be carried after proper reviews and modification in the document after getting approval 
from the configuration control committee, 
4.3 Coding: 

Befonj starting tlie AOCC software coding, a detailed coding guideline document 
Vi/as prepared, which was outoqma of export committee recommendations. This 
document was circulated to alE the software code developers. Detailed guidelinos are 
given in ref[9]. 

For AOCC software coding, bottom up approach was adopted. Here coding 
started with the boitommosi unit. After coding, code review for the unit was carried out 
and review recommendations were incorporated. Then the unit was compiled using 
US-DOD approved TLD Ada compiler and unit was linked using TLD linker. Stbibs 
replaced all other modules and unit testing was carried out ueing TLD simulator v/ith tho 
help of TLD debugger Unit testing; consists of lo^ic checks, flow checks, 
computationa! accuracy chaok for computation bound units. Samo philosophy was 
used to code procedures, modules and packages. Proper documents were made by 
giving full details of test vectors, errors uncovered, types of error, corrective action taken 
etc. Suitable test scripts were written to provide lest conditions, input values, since the 



snrulalor docs not support input/output opei-ation^. fn this manner complete AOCC 
software was integrated & tested using TLD simulator witii tha help of TLD debugger 
exccp! iFor IJO operations. 

A team of experts carried out code walfc-tti rough u&ing tlie Design document and 
Code documer^l before fi^nai impiemontation, The comments/rewmmendation giveri by 
l!he code walK through commiltee were inoorporated ancT the software review commiitee 
reviewed the ftjK AOCC software. Software review committee recommendation wai 
also incorporated in the AOCC SW and Finai version of Ihe AOCC S/W was released 
l^lor flight use. 
4,4 Testing: 

Testing starts with iniliai unil model dcvaiopmenl ilseff. Test plans were worked 
out from the SAV design document by giving fuil deiails of each and every test that arc 
to be carried out to verify and validate tiie AOCC SM- A test document was prepared 
by the Qualiiy Assurance Team, After the ffna! code dovqlopment, the loaded modiuic 
generated by the TLD linker are down ioadad inte ihe in-house developmont tool (DT) 
and the DT is interfaced with actual AOCC hl'W. Here each module timing 
measurement was carried out. After getting the each module timing, modules are 
placed to meet the timing requirement. This completed the final software coding 
operation. After this the load module generated by TLD linker is converted Into binary 
file for fusing into PROMs . Unisi:te Data lO programmer was used to fuse the SAW 
code into PROMS. InitiaJly one set of EPROMS was fused and will be mounted onto 
She AOCC processor card. One: test was conducted just to check the tunctionality. 
Once the AOCC Is working m this configuration, tho same S/W is fused into PROMS 
ar^d PROMS are entbedded inside AOCC processor card. 

The final testing of AOCC is carried out using a Test Systerrr, which simulates all 
the interfaces the AOCC is having on tho spacecraft. Tests are conducted as per test 
plan document. The tests conducted are Initial Etench Test - Functional verification, 
MILS test, Envirorimental Test and integrated spacecraft Test. 
5, Software Performance 

The software had been extensively icstad at ground before launch during 
various phases of testing. After launch, the S/C had been operated in almost all 
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modes like launcher phase. South Sun acquisition, Earth acqufsition, Station keeping 
and normal On-orl:Hit moid'os. No major probtcmE have been observed. The time 
estimetioin was found aatisfactory. No casos ot computation ovRrtlows^uriderflows have 
been observed. However, tJioro have been some feed backs an better monitoriny 
parg meters wlitch can bo upgraded' in th& future mission for better ovaiuation of (he on 
csrbit performance, There were certain observations during rhe S/W evaluation, whicli 

I arc riReded to be considered in future. They are briefly discussed here. 

' - The timing overhead in calling a routine was very high. This has to be Estubied 

' further, 

I 

The I/O instruction's execution time of IUIL-STO-17S0 processor (MAR 2Sl) was 
found to be very high. In future, desigri rnemory mappod l/Os can be thought off 
for better time perfomianca. 

The scaling requirements or) paromctcrs are avoided by use of floating point 
vanables, ]n coritinuous long run, single precision (32 bit) as well as extended 
I precision (46 tjit) {with truncation errors) may introduce Inaccuracy. Therefore 

I upper bound on each of the number need to be defined suitably. 

&. Conclusion 

The Attitude and Orbit Control Computer SyW of INSAT-2E is a mission critical 
software. This SAV is successfully designed, developed and used using MIL-STD- 
1750A processor with Ada language, A systematic, but simpio development 

methodology has been used tor S/W deveiopmenr. Though there were no problems 
found either on ground or on-board, it requires further improvement in reducing liming 
oveTfiead and improving truncationai inaccuracies. The AOCC is working continuously 
. in INSAT-2E S/C sinco the day of launch i.e., 3'^ April 1999. 
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